gix & gix-validate Submodule Path Traversal & Trust Inheritance Flaw Analysis

Vulnerability Summary Overview Title: Submodule Name Validation Bypass + Trust Inheritance Flaw Leading to Path Traversal and Credential Leakage Severity: High Affected Packages: - (Rust): Affected versions ≤ 0.72.0, Fixed in versions ≥ 0.82.0 - (Rust): Affected versions ≤ 0.10.0, Fixed in versions ≥ 0.11.1 Vulnerability Type: Path Traversal + Trust Inheritance Flaw Root Cause: 1. Validation Bypass: The function in uses to check only the first occurrence of . If appears in a non-traversal context (e.g., ), the function returns without checking the subsequent content. 2. Trust Inheritance Bypass: In , the submodule inherits the parent repository's (typically ), which causes ownership checks to be completely skipped, allowing the traversed path to be opened in full trust mode. Scope of Impact Affected Versions: - ≤ 0.72.0 - ≤ 0.10.0 Impact: - Attackers can construct malicious repositories containing a file to read arbitrary Git repository configurations (including credentials) via submodule path traversal. - Credential Leakage: Fields such as , (containing Bearer tokens), and in under the traversed path can be read. - Attack vector: via , requiring user interaction (submodule operations); high impact on confidentiality. Remediation 1. Fix Validation Logic: Change to check all occurrences of (not just the first one). 2. Invoke Validation Function: Call before constructing the path in . 3. Prohibit Trust Inheritance: When opening a submodule repository, do not inherit from the parent repository; always re-derive the trust level from path ownership. POC Code Attack Chain 1. The attacker constructs a repository containing a file: 2. The victim clones the repository using a Gitoxide-based tool. 3. The tool iterates over submodules and calls or : - returns , which resolves to the parent repository's . - opens with (inherited from the parent repository, skipping ownership checks). - The parent repository's is fully parsed. 4. The returned object exposes all configuration values under the traversed path: - (may contain ) - (often contains ) - fields - 5. These values can be accessed via standard APIs: , , etc.

Goal Reached Thanks to every supporter — we hit 100%!

gix & gix-validate Submodule Path Traversal & Trust Inheritance Flaw Analysis

More from this source